Posts

Foundation in Mobile Phone Forensics

4½ days • Classroom

Course information

This 4½ day, entry level course is targeted at those just starting out in mobile forensics, or existing mobile device examiners who have not had the benefit of formal training.

Course aims

Foundation in Mobile Phone Forensics is a 4½ day training course designed to teach prospective or existing mobile phone examiners how to examine mobile devices in accordance with the ACPO Principles of Digital Computer Based Evidence. Without appropriate training, there is a significant risk that evidence may be lost or altered during the examination process, or that the examiner is discredited in court. The course will provide delegates with exposure to, and hands-on experience with, market leading phone forensic tools.

What you will learn

By the end of the course, students will be able to:

  • Safely retrieve evidence from SIM cards, mobile phone handsets and memory cards using forensic software tools
  • Identify key potential evidence which is not recovered by software tools and capture it in an appropriate way
  • Implement or enhance local standard operating procedures for the examination of mobile devices within their organisation
  • Explain and justify their actions in court

Who should attend?

This entry level course is targeted at those just starting out in mobile phone forensics, or existing mobile phone examiners who have not had the benefit of formal training.

Foundation in Mobile Phone Forensics

4½ days • Classroom

Course information

This 4½ day, entry level course is targeted at those just starting out in mobile forensics, or existing mobile device examiners who have not had the benefit of formal training.

Course aims

Foundation in Mobile Phone Forensics is a 4½ day training course designed to teach prospective or existing mobile phone examiners how to examine mobile devices in accordance with the ACPO Principles of Digital Computer Based Evidence. Without appropriate training, there is a significant risk that evidence may be lost or altered during the examination process, or that the examiner is discredited in court. The course will provide delegates with exposure to, and hands-on experience with, market leading phone forensic tools.

What you will learn

By the end of the course, students will be able to:

  • Safely retrieve evidence from SIM cards, mobile phone handsets and memory cards using forensic software tools
  • Identify key potential evidence which is not recovered by software tools and capture it in an appropriate way
  • Implement or enhance local standard operating procedures for the examination of mobile devices within their organisation
  • Explain and justify their actions in court

Who should attend?

This entry level course is targeted at those just starting out in mobile phone forensics, or existing mobile phone examiners who have not had the benefit of formal training.

Foundation in Mobile Phone Forensics

4½ days • Classroom

Course information

This 4½ day, entry level course is targeted at those just starting out in mobile forensics, or existing mobile device examiners who have not had the benefit of formal training.

Course aims

Foundation in Mobile Phone Forensics is a 4½ day training course designed to teach prospective or existing mobile phone examiners how to examine mobile devices in accordance with the ACPO Principles of Digital Computer Based Evidence. Without appropriate training, there is a significant risk that evidence may be lost or altered during the examination process, or that the examiner is discredited in court. The course will provide delegates with exposure to, and hands-on experience with, market leading phone forensic tools.

What you will learn

By the end of the course, students will be able to:

  • Safely retrieve evidence from SIM cards, mobile phone handsets and memory cards using forensic software tools
  • Identify key potential evidence which is not recovered by software tools and capture it in an appropriate way
  • Implement or enhance local standard operating procedures for the examination of mobile devices within their organisation
  • Explain and justify their actions in court

Who should attend?

This entry level course is targeted at those just starting out in mobile phone forensics, or existing mobile phone examiners who have not had the benefit of formal training.

Foundation in Mobile Phone Forensics

4½ days • Classroom

Course information

This 4½ day, entry level course is targeted at those just starting out in mobile forensics, or existing mobile device examiners who have not had the benefit of formal training.

Course aims

Foundation in Mobile Phone Forensics is a 4½ day training course designed to teach prospective or existing mobile phone examiners how to examine mobile devices in accordance with the ACPO Principles of Digital Computer Based Evidence. Without appropriate training, there is a significant risk that evidence may be lost or altered during the examination process, or that the examiner is discredited in court. The course will provide delegates with exposure to, and hands-on experience with, market leading phone forensic tools.

What you will learn

By the end of the course, students will be able to:

  • Safely retrieve evidence from SIM cards, mobile phone handsets and memory cards using forensic software tools
  • Identify key potential evidence which is not recovered by software tools and capture it in an appropriate way
  • Implement or enhance local standard operating procedures for the examination of mobile devices within their organisation
  • Explain and justify their actions in court

Who should attend?

This entry level course is targeted at those just starting out in mobile phone forensics, or existing mobile phone examiners who have not had the benefit of formal training.

Advanced Smartphone & Tablet Acquisition

4½ days • Classroom

Background

The prevalence of smartphone and tablet devices is a mixed blessing for digital forensic units. On the one hand, iPhone, iPad and Android devices can provide a wealth of information about the owner’s communication, associates and whereabouts; but at the same time the built-in security mechanisms provided by such devices often present a significant challenge.

Course aims

Many Android apps exclude themselves from the backup mechanisms used by commercial forensic tools and additionally, device manufacturers and 3rd party app developers provide easy to use app protection and data hiding features. It is increasingly important that mobile forensic examiners can assess the completeness of extractions and take necessary steps to recover missing, hidden or protected data.

Not only is data being more tightly secured within mobile devices, increasing amounts of data are being stored in the cloud, either by the device itself or by apps installed on it. Today’s forensic examiners need to be aware of the breadth and depth of data held within the cloud and how it can be recovered for evidential use.

Advanced Smartphone & Tablet Acquisition is a 4½ day course designed to teach attendees how to ensure maximum evidence recovery. Delegates will learn how to identify and recover evidence from encrypted PC backups of iOS devices and use the Google Android SDK to recover data from any Android device. Importantly, delegates will gain hands-on experience in recovering data for apps such as WhatsApp and Facebook Messenger which exclude themselves from the backup process as well as techniques for dealing with data hiding mechanisms including Samsung Secure Folder and Huawei PrivateSpace. In addition to device extraction techniques, delegates will gain practical experience in the potential benefits of, and obstacles to, recovering cloud-based data.

What you will learn

By the end of the course, students will be able to:

  • Use ADB commands to connect to and recover data from Android devices
  • Recover evidence from PC backups of iOS & Android devices
  • Extract messaging app data from Huawei devices
  • Identify the use of data hiding techniques on Android devices which may prevent data extraction via forensic tools
  • Explain and justify their actions in court

Who should attend?

This course is targeted at existing phone examiners who have at least 6 months experience in mobile device forensics. Ideally, delegates would have previously attended the Control-F Foundation in Mobile Phone Forensics (or equivalent).

Advanced Smartphone & Tablet Acquisition

4½ days • Classroom

Background

The prevalence of smartphone and tablet devices is a mixed blessing for digital forensic units. On the one hand, iPhone, iPad and Android devices can provide a wealth of information about the owner’s communication, associates and whereabouts; but at the same time the built-in security mechanisms provided by such devices often present a significant challenge.

Course aims

Many Android apps exclude themselves from the backup mechanisms used by commercial forensic tools and additionally, device manufacturers and 3rd party app developers provide easy to use app protection and data hiding features. It is increasingly important that mobile forensic examiners can assess the completeness of extractions and take necessary steps to recover missing, hidden or protected data.

Not only is data being more tightly secured within mobile devices, increasing amounts of data are being stored in the cloud, either by the device itself or by apps installed on it. Today’s forensic examiners need to be aware of the breadth and depth of data held within the cloud and how it can be recovered for evidential use.

Advanced Smartphone & Tablet Acquisition is a 4½ day course designed to teach attendees how to ensure maximum evidence recovery. Delegates will learn how to identify and recover evidence from encrypted PC backups of iOS devices and use the Google Android SDK to recover data from any Android device. Importantly, delegates will gain hands-on experience in recovering data for apps such as WhatsApp and Facebook Messenger which exclude themselves from the backup process as well as techniques for dealing with data hiding mechanisms including Samsung Secure Folder and Huawei PrivateSpace. In addition to device extraction techniques, delegates will gain practical experience in the potential benefits of, and obstacles to, recovering cloud-based data.

What you will learn

By the end of the course, students will be able to:

  • Use ADB commands to connect to and recover data from Android devices
  • Recover evidence from PC backups of iOS & Android devices
  • Extract messaging app data from Huawei devices
  • Identify the use of data hiding techniques on Android devices which may prevent data extraction via forensic tools
  • Explain and justify their actions in court

Who should attend?

This course is targeted at existing phone examiners who have at least 6 months experience in mobile device forensics. Ideally, delegates would have previously attended the Control-F Foundation in Mobile Phone Forensics (or equivalent).

App Investigator 1

5 days • Online (instructor-led)

Background

Smartphone and tablet devices submitted to forensic units present a veritable treasure trove of potential evidence generated through the use of pre-installed “1st party” and user-installed 3rd party apps. Unfortunately the relentless evolution of new and existing 3rd party apps means that commercial forensic tools cannot realistically decode, interpret and report all of the data of interest to investigators.

Course aims

Android and iOS platforms both make extensive use of SQLite, a free open-source database platform, to store data relating to first and third party apps. Analysis of SQLite databases can recover live and deleted data as well as often overlooked binary data such as thumbnail images. In addition to SQLite databases, iOS devices make use of Property List (plist) files to store application data and mobile forensic examiners need to be skilled in analysing and reporting data from both file formats.

App Investigator 1 is an instructor-led online course designed to teach delegates how to recover evidence from smartphone and tablet applications. This includes first party apps, but the emphasis will be on developing skills and techniques for working with 3rd party apps which are unsupported by commercial forensic tools. Delegates will gain experience of working with data recovered from iOS and Android devices.

What you will learn

By the end of the course, students will be able to:

  • Locate view and recover evidence from SQLite databases used by smartphone applications
  • Maximise evidence recovery from SQLite databases through appropriate handling and analysis of associated Write Ahead Logging (WAL) files
  • Locate, view & recover evidence from Property List (plist) files used by iOS and associated applications
  • Manually decode smartphone apps
  • Explain and justify their actions in court

Who should attend?

This course is targeted at existing phone examiners who have at least 6 months experience in phone forensics. Ideally, delegates would have previously attended the Control-F Foundation in Mobile Phone Forensics (or equivalent).

Technical requirements

Delegates will remotely log in to a Control-F PC to undertake the training and as such will require a computer with a minimum 10MB Internet connection. Prior to the course a technical trial will be conducted with prospective delegates to ensure that the remote login capability is compatible with their IT infrastructure.

Delegates will also require a webcam, speakers (or headset). Delegates are strongly recommended to ensure they have access to dual monitors (one screen for remote access and a second to view the training materials).

 

App Investigator 1

5 days • Online (instructor-led)

Background

Smartphone and tablet devices submitted to forensic units present a veritable treasure trove of potential evidence generated through the use of pre-installed “1st party” and user-installed 3rd party apps. Unfortunately the relentless evolution of new and existing 3rd party apps means that commercial forensic tools cannot realistically decode, interpret and report all of the data of interest to investigators.

Course aims

Android and iOS platforms both make extensive use of SQLite, a free open-source database platform, to store data relating to first and third party apps. Analysis of SQLite databases can recover live and deleted data as well as often overlooked binary data such as thumbnail images. In addition to SQLite databases, iOS devices make use of Property List (plist) files to store application data and mobile forensic examiners need to be skilled in analysing and reporting data from both file formats.

App Investigator 1 is an instructor-led online course designed to teach delegates how to recover evidence from smartphone and tablet applications. This includes first party apps, but the emphasis will be on developing skills and techniques for working with 3rd party apps which are unsupported by commercial forensic tools. Delegates will gain experience of working with data recovered from iOS and Android devices.

What you will learn

By the end of the course, students will be able to:

  • Locate view and recover evidence from SQLite databases used by smartphone applications
  • Maximise evidence recovery from SQLite databases through appropriate handling and analysis of associated Write Ahead Logging (WAL) files
  • Locate, view & recover evidence from Property List (plist) files used by iOS and associated applications
  • Manually decode smartphone apps
  • Explain and justify their actions in court

Who should attend?

This course is targeted at existing phone examiners who have at least 6 months experience in phone forensics. Ideally, delegates would have previously attended the Control-F Foundation in Mobile Phone Forensics (or equivalent).

Technical requirements

Delegates will remotely log in to a Control-F PC to undertake the training and as such will require a computer with a minimum 10MB Internet connection. Prior to the course a technical trial will be conducted with prospective delegates to ensure that the remote login capability is compatible with their IT infrastructure.

Delegates will also require a webcam, speakers (or headset). Delegates are strongly recommended to ensure they have access to dual monitors (one screen for remote access and a second to view the training materials).

 

Acquiring Challenging Computer Devices

2 days

Background

The forensic acquisition of computer devices has been made more challenging through the shift from removable hard disk and solid-state drives to “soldered on” flash memory storage. The inability to remove (and image) the storage is further compounded in some devices by the presence of encryption and dedicated security chips, both of which can hamper acquisition via bootable media.

This situation presents multiple challenges to those tasked with forensically acquiring computers. If active encryption is not identified and addressed at seizure, it may be impossible to subsequently decrypt data held on the device. Without the necessary knowledge and specialist tools, “secure boot” features within Windows, Mac and Chromebook devices may prevent any data from being recovered from the device. Even worse, failing to follow correct procedures when acquiring a Chromebook can lead to irretrievable loss of data from the device.

Course aims

Acquiring Challenging Computer Devices is a 2 day course designed to teach delegates how to acquire Microsoft Surface Pro, Apple Mac and Chromebook devices. Fundamental to successful acquisition is not only the accurate identification of the device type, but in the case of Apple Mac devices, determining which specific security platform the device utilises (notably T2 and M1 chips). Once the security platform has been confirmed, appropriate steps can be taken to enable data acquisition.

Delegates will learn how to identify the presence of active BitLocker encryption on Surface Pro devices, perform live acquisitions of powered-on devices and take appropriate action to capture BitLocker recovery keys (which may be essential to subsequent analysis). During what is a highly practical course, delegates will create and use bootable media to recover data from both Chromebook and Surface Pro devices. 

What you will learn

By the end of the course, delegates will be able to:

  • Recognise if BitLocker is enabled on a Microsoft Surface Pro and use bootable media to acquire it
  • Capture decrypted logical backups of Chromebook devices
  • Distinguish between T2 and M1 series Apple computers and perform forensic acquisitions of both
  • Explain & justify their actions in court

Who should attend?

This intermediate level course is targeted at personnel responsible for forensically acquiring computer devices within a lab environment as well as those tasked with securing digital evidence “at scene”.  Delegates should have at least 6 months experience in computer acquisition and have previously attended the Control-F Foundation in Securing Computer Evidence (or equivalent).

 

Acquiring Challenging Computer Devices

2 days

Background

The forensic acquisition of computer devices has been made more challenging through the shift from removable hard disk and solid-state drives to “soldered on” flash memory storage. The inability to remove (and image) the storage is further compounded in some devices by the presence of encryption and dedicated security chips, both of which can hamper acquisition via bootable media.

This situation presents multiple challenges to those tasked with forensically acquiring computers. If active encryption is not identified and addressed at seizure, it may be impossible to subsequently decrypt data held on the device. Without the necessary knowledge and specialist tools, “secure boot” features within Windows, Mac and Chromebook devices may prevent any data from being recovered from the device. Even worse, failing to follow correct procedures when acquiring a Chromebook can lead to irretrievable loss of data from the device.

Course aims

Acquiring Challenging Computer Devices is a 2 day course designed to teach delegates how to acquire Microsoft Surface Pro, Apple Mac and Chromebook devices. Fundamental to successful acquisition is not only the accurate identification of the device type, but in the case of Apple Mac devices, determining which specific security platform the device utilises (notably T2 and M1 chips). Once the security platform has been confirmed, appropriate steps can be taken to enable data acquisition.

Delegates will learn how to identify the presence of active BitLocker encryption on Surface Pro devices, perform live acquisitions of powered-on devices and take appropriate action to capture BitLocker recovery keys (which may be essential to subsequent analysis). During what is a highly practical course, delegates will create and use bootable media to recover data from both Chromebook and Surface Pro devices. 

What you will learn

By the end of the course, delegates will be able to:

  • Recognise if BitLocker is enabled on a Microsoft Surface Pro and use bootable media to acquire it
  • Capture decrypted logical backups of Chromebook devices
  • Distinguish between T2 and M1 series Apple computers and perform forensic acquisitions of both
  • Explain & justify their actions in court

Who should attend?

This intermediate level course is targeted at personnel responsible for forensically acquiring computer devices within a lab environment as well as those tasked with securing digital evidence “at scene”.  Delegates should have at least 6 months experience in computer acquisition and have previously attended the Control-F Foundation in Securing Computer Evidence (or equivalent).